llllllllllllllllllliElllllllllllllllllllllUII 

US006275599B1 

(12) United States Patent (i<» Patent No,: US 6,275,599 Bl 

Adler et al. (45) Date of Patent: Aug. 14, 2001 



(54) COMPRESSED IMAGE AUTHENTICATION 
AND VERIFICATION 



(75) Inventors: Roy L. AdJer, Chappaqua; Bruce P. 

Kitchens, Millwood; Charles P. 
Tresser, Mamaroneck; Chal W. Wu, 
Ossining, all of NY (US) 



(73) Assignee: International Business Machines 
Corporation, Armonk, NY (US) 

( * ) Notice: Subject to any disclaimer, the term of this 
patent is extended or adjusted under 35 
U.S.C. 154(b) by 0 days. 

(21) Appl. No.: 09/143,354 

(22) Filed: Aug. 28, 1998 

(51) Int. CI. 7 G06K 9/00 

(52) U.S. CI 382/100 

(58) Field of Search 380/54, 3, 4, 23, 

380/55, 10, 49; 283/73, 113, 17; 382/100, 
232, 233, 244, 248, 250, 251; 348/403, 
473; 713/176 

(56) References Cited 

U.S. PATENT DOCUMENTS 
6,037,984 * 3/2000 Isnardi et al 348/403 



6,064,764 ♦ 5/2000 Bhaskaran et al. 
* cited by examiner 



382/183 



Primary Examiner — Samir Ahmed 

(74) Attorney, Agent, or Firm— McGuireWoods, LLP; 

Stephen C. Kaufman 



(57) 



ABSTRACT 



A watermarking method involves mostly invisible artifacts 
and is sensitive to any modification of the picture at the level 
of precision rendered by the compressed version of the 
image. The image is compressed according to a known 
compression standard, such as the JPEG standard, and with 
a fixed quality setting. Using the JPEG standard, the original 
image is cut into blocks to which the Discrete Cosine 
Transform (DCT) is applied and the DCT coefficients quan- 
tized. The watermark according to the invention is applied to 
the quantized DCT coefficients. This is done using an 
encryption function, such as a secret key/public key algo- 
rithm. The JPEG compression is then completed using a 
lossless compression scheme, such as Huffman coding, to 
produce the compressed and watermarked image. Authen- 
tication of the compressed and watermarked image begins 
with a lossless decompression scheme to obtain the set of 
quantized DCT coefficients. The coefficients are 
authenticated, and the DCT output of each block is dequan- 
tized. If necessary, an inverse DCT is applied to each block 
to output the decompressed watermarked image. 

13 Claims, 12 Drawing Sheets 
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COMPRESSED IMAGE AUTHENTICATION Processing 1997, pp. 11-680-683, describes watermarking 

AND VERIFICATION schemes where the owner of a data set incorporates an 

imperceptible watermark into the data set. In "The Trust - 

BACKGROUND OF THE INVENTION worthy Digital Camera: Restoring Credibility to the Photo- 

i u r .u t 5 graphic Image" G. L. Friedman, IEEE Trans, on Consumer 

1. Field of the Invention ^ vd 39j no ^ pp 905 _ 910t 1993> and in y s Pa( No 

The present invention gencraUy relates to imperceptible 5,499,294 by G L. Friedman, a digital camera is proposed 

watermarking of images and, more particularly, to water- wn ich uses cryptography to create a signature for authenti- 

marktng implemented on the compressed version of an cal i ag the images generated. In the invention of Friedman, 

image in a way that allows the usage of public key cryp- 10 a coded message is attached to the picture to allow the 

tography. authentication. 

2. Background Description It was argued that it is better to incorporate the authen- 
The image to be watermarked is assumed to be in digital heating message into the picture in U.S. patent application 

form. An imperceptible watermark (hereafter watermark for Ser. No. 09/059,498 to D. Coppersmith et aL, where solu- 

short) is denned as an alteration of the data set which is * 5 tions to do so were proposed. In U.S. patent application Ser. 

mostly not perceptible to a human, but can be recognized by No. 08/918,163 to S. Shimizu, M. Numao and N. Morimoto, 

a machine such as a computer. Otherwise, the watermark filed Aug. 25, 1997 and entitled "A System for Embedding 

should be (mostly) invisible. The general principle of such Authentication Information into an Image and an Image 

a watermark has been disclosed, for instance, in "Digital Alteration Detecting System", the signature of part of an 

Watermarking for High-quality Imaging", by M. M. Yeung, 20 image is embedded into another part of an image. 

F. C. Mintzer, G. W. Braudaway, and A, R.Rao, Proceedings Image watermarking algorithms have been proposed 

of the IEEE Signal Processing Society Multimedia which modify the DCT coefficients as for example in 

Workshop, Princeton, NJ., 1997. Here we are interested in "Transparent robust image watermarking" by M. D. 

fragile watermarks, by which we mean watermarks which Swanson, B. Zhu and A. H. Tewfik, Proceedings of the Int. 

allow the recognition that an image is authentic and has not 25 Conf. on i ma ge Proa, 1996, vol 3, pp. 211-214 and in 

been altered, rather that in robust watermarks which are "Hidden signatures in images" by C. T. Hsu and J. L. Wu, 

mainly devoted to establish ownership. Such fragile water- Proceedings of the Int. Conf. on Image Proa, 1996, vol.3, 

mark schemes already exist with several virtues as for pp. 223-226. However, these algorithms differ from the 

example in copending U.S. patent application Ser. No. present invention in the following ways: 

09/059,498 to D. Coppersmith, F Mintzer, C. Tresser, C. W. 30 l. in the above prior art, the emphasis is on robust 

Wu, and M. M. Yeung, filed Apr. 13, 1998 and entitled watermarks, where some error in the watermark is tolerated, 

"Secured Signal Modification and Verification with Privacy whereas the current invention is used as fragile watermarks 

Control". Here we are interested in a fragile watermark where any error in the authentication implies that the image 

scheme which is compatible with image compression. The has been tampered with. 

discussion will be organized around JPEG compressed 35 2. In the above prior art, the DCT coefficients rather than 
images, as described in JPEG Still Image Compression me quantized DCT coefficients are modified in the water- 
Standard by W. B. Pennebaker and J. L. Mitchell published marking procedure. This results in a watermark which will 
by Van Nostrand Reinhold, New York, 1993. However, be changed when JPEG compression is applied by the image 
anybody versed in the art of computer imaging would a nd thus cannot be used as a fragile watermark, 
readily understand how to adapt this invention to other « 3> ^ the above prior art? me wat ermark does not depend 
compression schemes as long as Oie leastvisible information 0Q thc imagc itsclf ^ alWs a malicious party to moc% 
content can be extracted and modified. The choice we have the image whiu retaining the wa termark and thus resulting 
made is mouvated by the fact that JPEG 1S a widely accepted in an image whkh fe stm authentia Therefore these algo- 
InternaUonal standard for image compression. rithms cannot be ^ to test whether the image has been 

A digitized color image could be thought of as a single tampered with. 
njxn 2 xN array with N^3. Here, the picture is supposed to 

be rectangular with n„ pixels in the horizontal direction, n 2 Problems to be Solved 

pixels in the vertical direction, and 3 is the minimal number Because of the huge size of color and even grey-scale 

of components for a color image. images, and the need of lots of them in industries like car 

Similarly, a digitized gray-scale image could be thought 50 insurance or lhe P ress > * a great advantage in keeping 

of as a single n,xn 2 array. The description of an embodiment a11 ima S es in a compressed form, for instance in the JPEG 

of the invention focuses on gray-scale images; however, the standard. If the authentication message is attached to the 

invention is readily applicable to other data sets in more P lcture as m Fnedman's invention, one can as well create the 

general sense, so that the word "image" could be replaced by message on the basis of the compressed version of the 

any other human perceptible data sets such as color images iraa B c - What thc P rcscnt invention achieves is to carry over 

or video. For definiteness, we will assume in the sequel that lhis P°ssiMlily to a watermarking scheme which incorpo- 

nj -n 2 -512, but more general cases would be treated by an rates thc authentication message in the picture compressed 

obvious adaptation of what will be presented here. In using a lossy compression scheme (for lossless compression 

particular, the essential invisibility of the artifacts generated „ schcmcs > one can use any watermarking scheme for uncom- 

by this invention should result in even less visibility for P ressed ima g es > as ™ the disclosure by Coppersmith et al.). 

color image than for grey-scale images. ^ watermarking scheme proposed here produces very 

faint modifications of the image which are mostly imper- 

Prior Art ceptible to the eye. 

Prior work such as "An Invisible Watermarking Tech- 65 SUMMARY OF THE INVENTION 

nique for Image Verification" by M. M. Yeung and F. C It is therefore an object of the present invention to provide 

Mintzer, Proceedings International Conference on Image a watermarking method that involves mostly invisible arti- 
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facts and is sensitive to any modification of the picture at the 
level of precision rendered by the compressed version of the 
image. 

According to the invention, the image is compressed 
according to a known compression standard, such as the 
JPEG standard, and with a fixed quality setting. Using the 
JPEG standard, the original image is cut into blocks to which 
the Discrete Cosine Transform (DCT) is applied and the 
DCT coefficients subsequently quantized. The watermark 



different level of significance. Accordingly, an invisible 
watermark will consist in a machine recognizable modifi- 
cation of all or part of the least significant numbers. The 
watermark can be made image dependent by letting this 
modification depend on the most significant numbers and 
choosing this dependence to be encrypted for better protec- 
tion, A lossy compressed image is also given in the form of 
a string of numbers (sometimes mixed with format 
instructions, but we can ignore those in the present 



according to the invention is applied to the quantized DCT 10 discussion), but now the numbers all have possibly essen- 
coefficients. This is done using an encryption function, such *»- c — ^- — * i---- 

as a secret key/public key algorithm. The JPEG compression 
is then completed using a lossless compression scheme, such 
as Huffman coding, to produce the compressed and water- 
marked image. Authentication of the compressed and water- 35 
marked image begins with a lossless decompression scheme 
to obtain the set of quantized DCT coefficients. The coeffi- 
cients are authenticated, and the DCT output of each block 
is dequantized. If necessary, an inverse DCT is applied to 



tially the same significance, so that the basic watermarking 
idea for uncompressed data as described above cannot be 
applied anymore. The present invention, in essence, 
comprises, for example, 

1. localizing those numbers such that a minimal modifi- 
cation of these numbers, called special numbers, leads to as 
invisible a modification of the image as possible (for 
instance, instead of the smallest absolute change in the 
image description as for the uncompressed image, one aims 



each block to output the decompressed watermarked image. 20 at the smallest relative change), and 

2. changing all or part of these special numbers in a 



BRIEF DESCRIPTION OF THE DRAWINGS 

The foregoing and other objects, aspects and advantages 
will be better understood from the following detailed 
description of a preferred embodiment of the invention with 
reference to the drawings, in which: 

FIG, 1 is a block diagram illustrating the watermarking 
mechanism of JPEG compressed images; 

FIG. 2 is a block diagram illustrating the authentication 
mechanism of watermarked JPEG compressed images; 

FIG. 3 is a diagram illustrating the decomposition of the 
image and the definition of sets D and S; 

FIG. 4 is a diagram showing an alternative choice for the 
sets D and S; 

FIG. 5 is a representation of an actual blue noise pattern 
for a set of 616 elements in a 512 by 512 image; 

FIG. 6 is a flow diagram illustrating the algorithm for 
generating and embedding the watermark into the image in 
the preferred embodiment; 

FIG. 7 is a flow chart illustrating the algorithm used to 
modify the coefficients C(B); 

FIG. 8 represents an original grey -scale image; 

FIG. 9 represents the same grey-scale image after JPEG 
compression; 

FIG. 10 represents the same grey-scale image after JPEG 
compression and the application of the disclosed watermark 
with the set S corresponding to FIG. 5; 

FIG. 11 represents the same grey -scale image after JPEG 
compression and application of the disclosed watermark 
with the set S corresponding to FIG. 4; and 

FIG. 12 is a flow diagram illustrating the algorithm for 



25 



30 



35 



45 



50 



machine recognizable way determined, using some 
algorithm, in a manner depending on the non-special num- 
bers. The algorithm here preferably chosen as some public 
encryption scheme, as for instance any of those described in 
"Handbook of Applied Cryptography" by Alfred S. 
Menezes, Paul C. van Oorschot and Scott A. Vanstone, CRC 
Press, 1997, but this is non essential for this invention. 

Referring now to the drawings, and more particularly to 
FIG. 1, we first describe the watermarking mechanism 
assuming the image is compressed using the JPEG standard 
with a fixed quality setting. The owner of image I 101 
constructs watermarked image r=W(I) 103 by implementing 
the following steps. First, the image is decomposed into 
blocks (genetically labeled B) of size 8 pixels by 8 pixels in 
function 104, according to the JPEG standard. Next, the 
DCT (Discrete Cosine Transform) 105 is applied to each 
block B giving an 8x8 matrix C(B) of DCT coefficients. 
These coefficients are then quantized by quantizer 106 to 
give a 8x8 matrix C(B) of so called quantized DCT coef- 
ficients C(i,j) with i and j between 0 and 7. C'(ij) is defined 
as C(i j)/s(ij) rounded to the nearest integer, where s(i,j) is 
the quantizer step size (see the above mentioned book by 
Pennebaker and Mitchell, pp. 376-377). Given a matrix 
C(B) corresponding to some JPEG block B, we define the 
pair (i*, j*) as the (ij) pair lowest in lexicographical order 
such that 

|C(iV)|-m«,JC(iJ)|, 

where the max function (greatest value function) is taken 
over all indices (ij) in the block one considers. We say that 
a DCT coefficient C(i,j) such that |C(ij)|=|C(i*, j*)| is a 
special frequency coefficient, and call any other DCT coef- 



authenticating the image using the coefficients in C(B) in 55 ficient a regular frequency coefficient. Information has been 



the preferred embodiment 

DETAILED DESCRIPTION OF A PREFERRED 
EMBODIMENT OF THE INVENTION 

In order to illustrate the novelty of this invention we 
propose doing so in full generality, i.e., without the need to 
specifically use the JPEG compression format. First, a 
fragile watermarking for uncompressed data is where an 
uncompressed image is given by a sequence of numbers 



lost by quantization, the degree of which depends on the 
quality setting which in turn depends on the image applica- 
tion. 

Normally, at the next stage the JPEG method uses a 
60 lossless compression scheme 107, such as Huffman coding 
for instance. According to the present invention, before the 
lossless compression is applied, the matrix C(B) of quan- 
tized DCT coefficients is changed for the special frequency 
coefficients in blocks B which belong to some special set S. 



(often binary numbers or bits, but we will say numbers for 65 The change in function block 102, which is either +1, 0, 
more generality), where blocks of numbers are associated to or-1, will be determined coefficients in matrices C'(B) for 
each pixel. The numbers attached to each pixel have a blocks B in set D, where D is defined as the set of blocks not 
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in S. The change could also be determined by further justice system can use this invention to provide tamper- 
information such as date, time and location information, and resistant fingerprint and photograph records. In this case, V 
so on, depending on application. The change is such that it can be kept secret by the agency generating these records, 
can be extracted from the changed quantized DCT cocffi- i.e., the owner and the user of the watermarking scheme are 
cients. The set of changes is called the watermark, 5 the same party. 

The rest of the JPEG algorithm (lossless encoding, etc) is This invention is different in two aspects from an authen- 

applied next. The alteration of the blocks is made so that the tication scheme where the authentication information is 

final product is still a valid image in the same JPEG format stored in the header portion of the JPEG file. First of alt, in 

as the unwatermarked image. The set S of blocks can be the present invention, the authentication information cannot 

regularly dispersed across the picture or placed differently, 10 be removed by simply removing the header. Furthermore, 

depending on application, typical examples being when the when the authentication information is stored in the header 

S blocks are dispersed according to some blue noise pattern portion of the JPEG file, it is relatively easy for a third party 

(see FIG. 3), when S corresponds to the boundary of the to determine whether an image is watermarked or not (by 

image (see FIG. 4), and when S covers the image. The checking whether there is a header or not), while in the 

matrices C'(B) for blocks B in set D and the regular 15 present invention, as the watermark is embedded into the 

frequency coefficients for blocks B in S determine the image itself, this is not the case. A description of the specific 

change in the special frequency coefficients in C'(B) for cryptographic techniques used (SK/PK pairs and hash 

blocks B in set S via some encryption method. In most cases, functions) can be found in Handbook of Applied 

one expects that it will be preferable to use some secret Cryptography, by Alfred J. Menezes, Paul C van Oorschot 

key/public key pair (for short SK/PK) to encode the authen- 20 and Scott A. Vanstone, CRC Press, 1997. 

tication message, but private cryptography would work just We now describe next a specific embodiment of the 

as well. For definiteness, we will assume public key cryp- invention. 

tography (i.e., using SK/PK) is used. Instead of using single With reference now to FIGS. 3 and 4, the image I 
sets D and S, one can as well use a plurality of them in order consisting of 512 pixels by 512 pixels is decomposed into 8 
to allow for authentication of pictures either cropped or 25 pixels by 8 pixels JPEG blocks. (For convenience in show- 
modified in some inessential way. ing I in a figure, the images I shown in FIG. 3 and FIG. 4 
A method to do so for uncompressed images and other consists of less pixels.) Thus, the image I can be thought of 
uncompressed data sets has been described in U.S. patent as a 64 blocks by 64 blocks array. These blocks are then 
application Ser. No. 09/059,498 to D. Coppersmith, F. et al. separated into the sets S and D, possible choices being those 
and the techniques described there can readily be adapted to 30 presented in FIGS. 3 and 5 (blue noise pattern) or in FIG. 4 
the present invention. The above-mentioned application also (boundary of the image). 

discusses privacy control in the sense that images can be A flowchart describing how the watermark is generated 

authenticated without the authenticating agent knowing the and embedded into the image (102 in FIG. 1) is shown in 

human-readable content of the image. Anyone of ordinary FIG. 6. With reference now to FIG. 6, a data set I 2 is formed 

skill in the art can adapt these privacy control aspects to the 35 in function block 601 by combining the frequency coeflfi- 

p resent invention. cients in all matrices C(B) from blocks B in D The data set 

Next, with reference to FIG. 2, we describe the authen- I 2 is then used in function block 602 to compute the reduced 

tication mechanism assuming that the image is watermarked data set I 3 =f(l^). In several applications, f will be chosen as 

and compressed using the JPEG standard as described a hash function (to reduce the size of the data set y or more 

above. To prevent unauthorized parties from being able to 40 precisely as a cryptographic hash function H which might be 

watermark an image, we assume that public key cryptogra- publicly known. Then, given any message M such as I^, it is 

phy with associated encoding and decoding functions V and easy for anyone to produce I 3 =H(M), but it is considered 

V 1 are used. As is well known (see for instance Handbook computationally infeasible for anyone to find two different 

of Applied Cryptography, by Alfred J. Menezes, Paul C. van messages M and M'with the same hash value H(M)=H(M I ). 

Oorschot and Scott A. Vanstone, CRC Press, 1997), the 45 Also, it is considered computationally infeasible for anyone, 

function V 1 is known publicly, but function V is known only given a hash value Y, to find a message M satisfying 

to some party called the owner and is secret in the sense that H(M)=Y. One such hash function is the Secure Hash Algo- 

it is considered computationally infeasible to determine it rithm (SHA-1). Specifically, we create I 3 -H(M) with 160 bit 

from function V 1 . where H is chosen as SHA-1 and, in function block 603, 

To authenticate a watermarked image 203 I'-W(I), one 50 append the owner's name (or ID number), time, date, 

begins by decompressing the lossless compression 206 in location etc., to produce a message I 4 . We require that this 

JPEG, to obtain the set of quantized DCT coefficients. The additional data occupies at most 44 characters or 352 bits so 

sets D, S are identified in function 208 and one checks using that I 4 has 512 bits. 

V 1 that the watermark is compatible with blocks in D in We choose the RSA protocol, described in U.S. Pat. No. 

function 207. If necessary, the JPEG decompression then 55 4,405,829, as a method to generate and use a SK/PK pair in 

proceeds by dequantizing the DCT output of each block in order to allow for public authentication. Several other meth- 

function 205 and performing the inverse DCT on each block ods for encryption such as DES could also be used, not 

to generate an output decompressed watermarked image necessarily of the SK/PK type. The signing function in the 

201. RSA protocol is denoted by SIGN=V and the verification 

We now describe two possible scenarios of how the 60 (authentication) function in the RSA protocol is denoted by 

invention may be used. A picture of an automobile accident VERIFYoV r 

is taken by a camera C with a function V only known to the Next, in function block 604, compute the RSA signature 

manufacturer of camera C (i.e., in this case, the owner is the i 3 -SIGN(SKJ 4 ) of 512 bits (604). For each block B in S, we 

manufacturer of C, and not the person willing to use the associate 1 bit b e{0,l }of I s , and in function block 605, we 

watermarking scheme). Both the owner of the automobile 65 change the special frequency coefficient C(i*, j*) of the 

and the insurance company are protected against possible matrix C(B) depending on this bit according to the follow- 

tampering with the image. As a second scenario, the criminal ing scheme. 
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With reference to FIG. 7, There are two cases to consider that the invention can be practiced with modification within 

at decision block 701. For each block, the pair (i*, j*) is the spirit and scope of the appended claims, 

determined as before. The first case is when CXi*, j*) is not Having thus described our invention, what we claim as 

at an extremity of the allowed values. The rest falls into the new and desire to secure by Letters Patent is as follows: 

second case. In case 1, decision block 702, if b is the bit 5 1. A method for watermarking an image to allow authen- 

associated with B, we change the coefficient C(i*, j*) in tication and verification of the image comprising the steps 

C(B) to the nearest coefficient with the same parity as b and of: 

with absolute value at least equal to |C(i*, j*)l in function quantizing the data describing the image; 

blocks 704 or 705. For example suppose that b=0. If C(i*, separating the quantized data into a first group and a 

j*) is even, we do not change C(i*, j*). If C(i*. j*) is odd, 10 Second group; 

C'(i*, J*) is changed to the nearest even coefficient with j. f . i! * r 1 r c c 

absolute value greater than |C'(i', j*)|. In case 2, in decision m ° dlfyi ° g . a ™ bset V^f, ^ °« 

block 703, for each coefficient C i,j) in block B with ^ T! V ^ S ° 

absolute value equal to |C(i% we change it to its nearest ^ ****** ^J™™ w *>> a an <"W™ 1 ° f 

rc • . ... ,i . . iii, ii at lowa Die Quantized data, 

coefficient with the same parity as b and absolute value less 15 ™. 4 . 1 e , . ^ , . iL . . 

than |C(i*, j*)| in function blocks 706 or 707. fl 2- The method of claim ^1 wherein the moMcaUons to the 

The set S must contain at least 512 blocks, now consid- ^ f °" P j ™ *»™* ■>£ at leasl one of (i) unmodified 

ered as bits. We choose 616 bits as an example, both in [|™ Qtl2cd data m thc 500011(1 gr0up and ^ P rcdctcrm ™ d 

FIGS. 4 and 5. Out of these bits, 512 are used for L so we - ' ~, iL , f , . - . . iL c , 

i#*> \*ft iintKi /ii/; <n m>i i aA f . # tl ~ , nA nn 3. The method of claim 1, wherein the first group is 

are leltwitn 616-512=104 bits left for other data: these 104 20 , . - , .. . J , , j-n 

u * — ti Jt . .- 4 . r determined as the quantized data where allowable modifi- 

bits are called the spare bits (there is no necessity for spare .„ , n iL , A . ... 

bits, but these can be used for instance to place uncoded "tons will be among the least visible. 

information or extra protection). In all cases when SK/PK 4 ™ e method ° f claim X > further com P risin g the ste P s of: 

pairs are used, the owner's name, time, and public key PK, decomposing the image into a plurality of blocks; 

are assumed to be available to the appropriate parties. One 25 quantizing each of the blocks; 

possibility is to embed the owner's name and the time in the separating the quantized blocks into a first group data 

spare low bits. block and a second group data block; 

Comparing FIGS. 8 to 11 will illustrate the quasi invis- determining the watermark by using the second group 

ibility of the watermark. FIG. 8 shows the original image data block and components of the first group; and 

while FIG. 9 shows the image after compressed with JPEG 30 modifying the first group using an encryption function to 

using standard quality settings. FIG. 10 shows the same embed the watermark. 

image compressed with JPEG and with a watermark embed- 5. The method of claim 4, further comprising transform- 

ded according to set S in FIG. 5. FIG. 11 shows the same ing the blocks before being quantized. 

grey-scale image after JPEG compression and application of 6. The method of claim 5, wherein said transforming 

the disclosed watermark with the set S corresponding to 35 includes Discrete Cosine Transform. 

FIG. 4. We see that FIGS. 10 and 11 are virtually indistin- 7. The method of claim 4, wherein the transforming and 

guisbable from FIG. 9. quantizing each of the blocks are carried out according to the 

Later, one wishes to verify that a data set is both authentic JPEG compression standard, 
and preserved in its original form. A flowchart describing the 8. The method of claim 7, wherein: 
verification procedure from the coefficients of C(B) (202 in 40 watermarked image is in JPEG format, 
FIG. 2) is shown in FIG 12. With reference to FIG. 12, after lossless com p re ssion k applied resulting m a water . 
decompressing the lossless decoding, the watermark I 5 is markcd imagc in jp EG formal 
extracted in function i block 801 and I 4 is computed in 9 ^ method of claim 4 ^ comprising applyi n g 
function blocks 802-804 from the coefficients C(B) of the lossless compression after watermarking to produce a water- 
data set as before. I 5 can be extracted by looking at whether 45 marked compressed image. 

C(i',j') in C(B) for B in S is even or odd (even correspond- 10 A method t0 em5ed a f Ue watermark in a com- 
ing to a bit 0 and odd corresponding to a bit 1), where (i'j') pressed re p resen tation of an image, comprising the steps of: 
is defined as any pair (i',y) such that modifying a subset of largest quantized Discrete Cosine 
lC(i* ni-max Icfihl Transform (DCT) coefficients of an image compressed 
tJ 50 according to JPEG format; 
Next, VERIFY (PK,I S ) is computed and a check in decision authenticating the originator of the image, and 
block 805 is made to check whether I 4 is equal to VERIFY verifying that the image has not been modified. 
(PK,I 5 ). (All this can be done with information available to 11. The method of claim 10, wherein said watermark is 
the appropriate parties.) If I 4 is equal to VERIFY(PK,I 5 ), 5S determined as a digital signature obtained from information 
then the image is authentic at output 807. Otherwise, the contained in the image and independent of a part of the 
image is not authentic at output 806. information in the image that carries the watermark. 

Although JPEG lossy compression is used throughout this 12. The method of claim 11, wherein said digital signature 

disclosure, this invention can be adapted to other compres- is computed using a public key signature scheme, 

sion algorithms such as MPEG, Wavelet or JBIG-2 by 6Q 13. The method in claim 12, wherein said public key 

anyone skilled in the art as long as the least visible infor- signature scheme uses an RSA public key cryptography 

mation content can be extracted and modified. Thus, while scheme, 
the invention has been described in terms of a single 

preferred embodiment, those skilled in the art will recognize * * * * * 
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